Qmail Support Forum

admin · Site Admin Joined: 21 Jun 2005 Posts: 209

Greylisting reduces the amount of spam delivered to e-mail addresses by capitalizing on spammers' reluctance to configure their mail servers according to internet standards (see http://www.ietf.org/rfc/rfc2821.txt.)

How does greylisting work?

With greylisting, we maintain a record of three pieces of information when an e-mail is received:

1.) The IP address of the machine sending the e-mail.
2.) The e-mail address of the person sending the e-mail.
3.) The e-mail address to which the e-mail is being delivered.

This set of information is captured and recorded on the server, and communication with the sender's server is terminated with an error code before the content of the e-mail message is received. Our servers reply to the sending server to say essentially "Sorry, we're too busy right now. Please try again to send this e-mail later." The error message (called a "400-level error") is specifically "temporary" and properly configured mail servers will queue the message and retry after some period of time.

After 5 minutes, our servers prepare to receive the e-mail again. When the delivery is attempted again - anytime over the next 4 hours - the servers match the information that was collected previously and the e-mail is delivered without delay. From that point on, anytime a message with the matching information is received by us, it is delivered immediately.

Why does greylisting work?

According to the internet specification, when a mail server receives a "400-level" error, it must queue the e-mail message and try later to deliver it. For legitimate e-mail, this process is standard and mandatory. Properly configured mail servers will redeliver their messages appropriately and greylisting should not represent a delivery challenge to them. Because spammers send hundreds of thousands of e-mails per day to addresses they do not know to be working, they generate a large number of bounced messages. Acknowledging server responses for these messages, storing the messages on a server for some period of time, and redelivering them again represents for spammers a resource-intensive process that might very well not return sales of their products or services. As a result, they intentionally misconfigure their mail servers. By requiring that every incoming e-mail message to our system originate from a properly configured mail server, most spam is filtered.

Note: Some spammers have started to configure their servers according to specifications, and therefore some spam may continue to enter our system, but at a dramatically reduced rate.

Should I worry about the privacy of my e-mail because of greylisting?

No. There are many reasons to assume that unencrypted e-mail is not private, but greylisting is not one of them. The SMTP servers only record information that is used to deliver every e-mail message, and this information is captured before the content of the e-mail is received. However, e-mail is delivered across a vast network of servers on the internet, any of which can potentially capture and copy the data passing through them. You might never have an indication that your e-mail is being read in cases like these.

There is no reason to assume that all -- or even many -- e-mail messages are being read in this way by malicious internet hosts. If privacy is a concern, there are several simple encryption methods that you can use to protect your e-mail messages.

Will my e-mail to be delayed?

E-mail affected by greylisting will be delayed a minimum of 5 minutes. This is the delay interval required by the SMTP servers in order to prevent immediate redelivery by already-connected spam servers. The message may be redelivered without challenge by the servers for up to 4 hours. After 4 hours, the original record of the message is destroyed and the challenge/redelivery process must begin again.

Internet specifications suggest that messages temporarily refused be redelivered within 4 hours, and most servers are configured to retry in far less time - often on the order of several minutes. The specific delay will depend on the configuration of the sender's e-mail servers.

If the e-mail message is not received within 4 hours, it is possible that the sender's e-mail server is not configured according to internet standards. Please contact us for help determining if this is the case. Copies of the headers from the bounced e-mail message will be necessary for diagnosis of the problem.

Please be aware that messages retrieved from external sources (via Fetchmail) can't be greylisted because the messages have already been accepted by that other mail server and internet standards prohibit rejecting a message that has already been accepted for processing.

More info at

http://projects.puremagic.com/greylisting/whitepaper.html